The University of South Florida’s CyberHerd team claimed first place at DEF CON 33’s “Adversary Wars” Capture the Flag, capping the competitive team’s debut at what is widely regarded as the largest hacking and security conference in the world. In the process, the CyberHerd bested more than 90 teams, including a three-time reigning champion team that included professionals from Singapore’s Cyber Security Agency.
In a buzzing Las Vegas convention center packed with thousands of cybersecurity pros from around the world, the air was filled with the click of keyboards, bursts of applause, and faces displaying intense concentration. For CyberHerd team members – Bellini College of Artificial Intelligence, Cybersecurity and Computing students Sanaan Wani, a computer science major; Fagan Afandiyev, a cybersecurity major; and Nevin Southammavong a cybersecurity major – it was both awe-inspiring and a chance to prove themselves on a global stage.
Adversary Village: a calculated choice
DEF CON 33 included 72 specialized “villages,” each hosting its own competitions in areas ranging from car hacking to industrial control systems. The Adversary Village, which focused on simulations, threat actor emulation and tools that merge offensive and defensive tactics, stood out to the USF CyberHerd attendees. Before committing to that village’s capture-the-flag competition, or CTF, the team scouted multiple villages, weighing rules, formats, and required skills.
In the field of cybersecurity, CTF competitions test how well contestants can exploit vulnerabilities in a system to capture or reveal hidden pieces of information.
“We checked out a lot of the villages to see which CTFs matched what we know and what we’ve practiced,” Wani said. “Some needed bigger teams or used skills we haven’t worked with as much. The Adversary Village lined up with what we’re good at, but it was still tough enough to really test us.”
That choice played to their strengths in web application security, APIs and cloud environments, skills honed through USF coursework and prior competitions.
“What we’ve learned at USF and the competitions we’ve done before really set us up for this,” Wani said. “Our classes gave us the technical foundation, and the other CTFs taught us how to work as a team under pressure.”
Against the best in the world
The competition roster was as intimidating as it was inspiring. “Usually, when we compete, it’s solely against other collegiate teams,” Wani said. “At DEF CON, it’s you against the world. Some people might shy away from that, but we wanted to see what we could do.”
The CyberHerd’s start was far from ideal. Because they scouted so many CTFs, the lost time that the competition used to get started. But they advanced quickly. Going into the final day in fourth place, they cracked a pivotal problem that pushed them into the top three. The digital scoreboard showed their quick climb.
“Third out of 90 wasn’t a bad place to be, but we wanted to win,” Wani said. He said that team clinched first place with a last-minute solve by Afandiyev and held it until time expired.
“We were on the cusp of either winning or coming in second. Luckily, we found a new attack path and that was it, no one else could catch us,” said Afandiyev.
“When we moved into first, it was both exciting and terrifying,” Wani said. “You see your name at the top of the scoreboard, and now you have to hold it.”
The CTF mirrored real-world vulnerabilities found in corporate and government systems, including one where competitors exploited a search field to reveal a database, a textbook SQL injection attack.
“This was one of the most competitive events in the world, and the challenges were not trivial,” said Marbin Pazos Revilla, an assistant professor of instruction and faculty advisor. “The students were able to connect the dots and do what they needed to win. These scenarios are very similar to how threat actors attack and exploit vulnerabilities.”
Celebrating the win
When the results were announced, the CyberHerd immediately called their faculty advisors to share the news.
“It’s a huge deal for a university team to win something like this,” Wani said. “We were excited, proud, and ready to celebrate. Later that night, I even signed us up for two more competitions.”
The experience was made possible through funding from CyberFlorida at USF, the state-wide center for cybersecurity, and its executive director, Gen. (Ret.) Frank McKenzie, expressed pride in the USF team.
“We’re off to a wonderful start,” he said.
“Cybersecurity is a hands-on field, and there’s no substitute for real-world, high-pressure experience,” McKenzie said. “By backing opportunities like DEF CON, we’re giving students the chance to grow their skills, test their knowledge, and discover what it takes to perform at an elite level.”
Faculty advisor Sriram Chellappan echoed McKenzie’s sentiments.
“The Bellini College of Artificial Intelligence, Cybersecurity and Computing and CyberFlorida are committed to getting our students into the competitive landscape of cybersecurity,” he said. “The CyberHerd is clear evidence of that commitment, and winning the Adversarial Wars CTF only affirms how our students are taking best advantage of opportunities we are providing them. These students are the future leaders of cybersecurity protecting national and global security.”
Aside from bragging rights, the top honor came with a voucher that each team member can use for future Offensive Security certifications, which typically cost more than $1,700. Each student will choose from a range of certification options offered by OffSec.
The victory has set a new standard for the CyberHerd.
“We’ve won on the biggest stage,” Wani said. “Now anything less than first is not acceptable.”